> For the complete documentation index, see [llms.txt](https://docs.t-rex.network/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.t-rex.network/reference/identity-suite/identity.md). # Identity `Identity` is the ONCHAINID of a participant or of an asset: an ERC-7579 smart account that carries a type, holds keys and claims through its registry module, and can hold tokens and execute calls. The concepts are in [An identity that is also an account](/identity-onchainid/an-identity-that-is-also-an-account.md) and [Keys, purposes and signers](/identity-onchainid/keys-purposes-and-signers.md). ### At a glance | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------- | | **Source** | `contracts/Identity.sol`, on `SmartAccount.sol` and `KeyManager.sol` | | **Interfaces** | `IIdentity`, `IERC734`, `IERC735` through the fallback, ERC-7579 account, ERC-4337 account, ERC-1271, ERC-165 | | **Deployed as** | A beacon proxy, by the `IdentityFactory`, at a CREATE3 address. Every identity follows the same beacon | | **Fixed at build time** | `registryModule()`, the `ERC734Validator`, and `identityFactory()`. Both are the same for every identity | | **Signing domain** | ERC-712 name `OnchainID`, version `1`, with the identity as verifying contract. Read it with `eip712Domain()` | ### Information | View | Returns | | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | `getIdentityType()` | The type set at creation: see the numbers in [Identity Suite](/reference/identity-suite.md) | | `version()` | The version of the implementation | | `accountId()` | The ERC-7579 account identifier: `trex.onchainid.identity.v` followed by the version | | `registryModule()`, `identityFactory()` | The module that holds the keys and claims, and the factory | | `initializedVersion()` | The initializer version stored on the contract. The factory reads it on an implementation before a beacon upgrade | | `supportsInterface(interfaceId)` | ERC-165. The claim interface is advertised only while the fallback that serves it is installed | `initialize(_identityType, _keys, _modules)` runs once, in the transaction that deploys the proxy. It reverts with `IdentityNoValidatorOrExecutor` when the modules contain neither a validator nor an executor, and with `InvalidSignerData`. It emits `IdentityInitialized`. ### Keys | Function | Access | Reverts with | | ---------------------------------------------------------------------- | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `addKeyWithData(_key, _purpose, _type, _signerData, _clientData)` | A `MANAGEMENT` key, or the identity itself | `SenderDoesNotHaveManagementKey`, `InvalidSignerData` unless `_key` is the hash of `_signerData`, `InvalidPurpose` outside 1 to 6, `KeyAlreadyRegistered` when the key already holds the purpose, `KeyTypeMismatch`, `ClientDataTooLong` | | `addKey(_key, _purpose, _type)` | A `MANAGEMENT` key, or the identity itself | The same. The key must already be known to the registry, which holds its signer data: otherwise `InvalidSignerData` | | `removeKey(_key, _purpose)` | A `MANAGEMENT` key, or the identity itself | `SenderDoesNotHaveManagementKey`, `KeyDoesNotHavePurpose`, `CannotRemoveLastManagementKey` | | `keyHasPurpose(_key, _purpose)` | Anyone, read | True when the key holds the purpose, or holds `MANAGEMENT` | | `getKey(_key)` | Anyone, read | The purposes, the type and the hash of a key | | `getKeyPurposes(_key)`, `getKeyPurposes(_key, start, end)` | Anyone, read | The purposes of a key, whole or by range | | `getKeysByPurpose(_purpose)`, `getKeysByPurpose(_purpose, start, end)` | Anyone, read | The keys that hold a purpose. For `MANAGEMENT`, the keys of modules are left out | The registry emits `KeyAdded` and `KeyRemoved`, with the identity as `account`. Guide: [22 Add and remove keys on an ONCHAINID](/guides/identity/22.-add-and-remove-keys-on-an-onchainid.md). ### Claims The identity routes these functions to the `ERC734Validator`, which describes them: see [ERC734Validator](/reference/identity-suite/erc734validator.md). | On the identity as holder of claims | On the identity as Claim Issuer | | ----------------------------------------------------------- | -------------------------------------------------------------------------------------- | | `addClaim`, `removeClaim`, `getClaim`, `getClaimIdsByTopic` | `addClaimTo`, `revokeClaimByDigest`, `isDigestRevoked`, `isClaimValid`, `getClaimHash` | `getClaimStatus` and `getMetadataHash` are functions of the module that the identity does not route. ### Execution | Entry point | Who | Behavior | | ---------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | A user operation (ERC-4337) | Any signer whose key is registered on the identity | The `ERC734Validator` checks the signature and the purpose of the key against the target of the call. `ACTION` is enough for an external target. A management target requires `MANAGEMENT` | | `execute(_to, _value, _data)` and `approve(_id, _shouldApprove)` | An address that holds a key, calling the identity directly | Routed to the `KeyApprovalModule`: see [KeyApprovalModule](/reference/identity-suite/keyapprovalmodule.md) | | An installed executor module | The module | The identity dispatches the call when the purpose registered for the module covers the target. Otherwise `ExecutorPurposeNotAuthorized` | * **Management targets.** `isManagementTarget(target)` is true for the identity itself, its factory and its key registry. A call to one of them requires `MANAGEMENT`. * **Own modules.** The identity refuses to dispatch a call into one of its own modules, with `OwnModuleTargetBlocked`. * **Modes.** `supportsExecutionMode(encodedMode)` tells which ERC-7579 modes are accepted. A delegate call is refused, with `UnsupportedExecutionMode`. * **Signatures.** ERC-1271 `isValidSignature` accepts a signature from a key that holds `ACTION` or `MANAGEMENT`. Claim, encryption and proposer keys cannot sign for the identity. ### Modules | Function | Access | Behavior | | ------------------------------------------------------------ | ------------------------------------------ | ------------------------------------------------------------------------------ | | `installModule(moduleTypeId, module, initData)` | A `MANAGEMENT` key, or the identity itself | Installs an ERC-7579 module. Emits `ModuleInstalled`, then `ModuleInstallData` | | `uninstallModule(moduleTypeId, module, deInitData)` | A `MANAGEMENT` key, or the identity itself | Removes it. Emits `ModuleUninstalled`, then `ModuleUninstallData` | | `isModuleInstalled(moduleTypeId, module, additionalContext)` | Anyone, read | | The modules an identity starts with are those the factory holds for its type. Guide: [28 Install the recovery module and manage guardians](/guides/identity/28.-install-the-recovery-module-and-manage-guardians.md). ### Events | Event | Emitted when | | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | | `IdentityInitialized(uint256 indexed identityType)` | The identity is created | | `CallDispatched(address target, uint256 value, bytes data, address caller)` | The identity dispatches a call for a key or a module | | `ModuleInstallData(uint256 moduleTypeId, address module, bytes initData, address caller)` | After the ERC-7579 event `ModuleInstalled`, which omits the data | | `ModuleUninstallData(uint256 moduleTypeId, address module, bytes deInitData, address caller)` | After `ModuleUninstalled` | Key and claim events are emitted by the `ERC734Validator`, and execution events by the `KeyApprovalModule`, each with the identity in its first argument. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.t-rex.network/reference/identity-suite/identity.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.